Actually, I think that a proxy might be a worse scenario in terms of exploitability. If the proxy that handles authentication has one notion of chunked encodin

Actually, I think that a proxy might be a worse scenario in terms of exploitability. If the proxy that handles authentication has one notion of chunked encoding and Kestrel behind it has another notion and the proxy then shares it's connection between users, then an attacker might smuggle in a request to a high value endpoint. For example: - Kestrel serves an application with the endpoints /public_get_stats and /admin/change_user_rights - The proxy makes sure everything under /admin is authorized - An attacker does a POST request to /public_get_stats , the post is sent with CHUNKED encoding that the proxy interprets in one way thus letting it be passed to Kestrel - Kestrel behind it starts processing /public_get_stats but mis-interprets the chunked boundary leaving the parser to start the next (malicious) request, that in turn contains, a payload saying {"userid":"hacker","level":"superuser"} to /admin/change_user_rights